Application of data fusion methodology for computer forensics dataset analysis to resolve data quality issues in predictive digital evidence

Abstract

The digital information systems have become increasingly complex and inex- tricably intertwined with the infrastructure of national, public, and private organizations. The forensic digital analysis as a whole, in its relative infancy, is the unwilling victim of the rapid advancement of computer technology, so it is at the mercy of ever more new and complex computing approaches. Forensic digital analysis is unique among the forensic sciences in that it is inherently mathematical and generally comprises more data from an investigation than is present in other types of forensics. The digital investigation process can be driven using numerous forensic investigation models. Among these is the need to analyze forensic materials over complex chains of evidence in a wide variety of hetero- geneous computing platforms. The current computer forensic investigation paradigm is laborious and requires significant expertise on the part of the investigators. This paper presents the application of JDL data fusion model in computer forensics for analyzing the information from seized hard drives along with an analysis of the inter- preted information to prove that the respective user has misused internet. This paper is an attempt to use the data fusion and decision mining processes, to help in enhancing the quality of the investigation process which is in turn is validated by statistical evalua- tion. The mining rules generation process is based on the decision tree as a classification method to study the main attributes that may help in detecting the suspicious behavior. A system that facilitates the use of the generated rules is built which allows investigating agencies to predict the suspicious behavior under study.